Mail protection internal mailserver on different port

Hallo,

Please insert a picture of the Edit of the DNAT that didn't work.

Also confirm that the traffic flow is:

     Internet <--- port 25 --> UTM SMTP Proxy <--- port 2525 ---> Mail server

Cheers - Bob

Hi Bob, yes, the flow is as you mentioned. Maybe just the server verification fails, I did not disable it. But it's all about the verification to SMTP 2525 to Exchange, otherwise the recipient filter does not work correctly. I could choose any other port than 25, that's is the problem. Recipient Filter on frontend connectors with Exchange 2013 upwards is working different.

A picture of the Bearbeitung of that rule, please.  Also open "SMTP-Empfang ex.kif.local" so that we can see what that is.

Cheers - Bob

I did a new screenshot and this is the target:

That's close, but you need something like:

     DNAT : Internet IPv4 -> SMTP -> External (Address) :to Exchange with SMTP-Empfang Exchange

2022-03-21 CORRECTION to not bypass the SMTP Proxy: 'DNAT : Internal (Address) -> SMTP -> Exchange : to SMTP-Empfang Exchange' which is what you had originally.  Apparently, recipient validation does not use port 25!

If Exchange also sends outbound mail on 2525, you will also want a rule like:

     SNAT : Exchange -> {port 2525} -> Internet IPv4 : from SMTP

However, if you want outbound mail to be processed by the SMTP Proxy, Exchange must use the UTM as a smart host and you will instead need something like:

     DNAT : Exchange -> {port 2525} -> Internal (Address) : to SMTP

Glück gehabt ?

Cheers - Bob

Hi Bob, not really "Glück". With that incoming rule I bypass the mailprotection completely. From my point of view, traffic should originate from the UTM itself, but I did not manage it with any DNAT rule I tried.

Ah, my mistake, I'll correct my post above.  Apparently, recipient validation does not use port 25!

Cheers - Bob

yes, validation must be performed on SMTP backend connector with Port 2525. I can not change to port 25, this way smtp frontend service would crash on Exchange 2013 and above. I use now mail users instead of mail contatcs, these could be validated by the UTM and AD query. Unfortunately, it still works only with LDAP unencrypted with UTM, not LDAPS

yes, validation must be performed on SMTP backend connector with Port 2525. I can not change to port 25, this way smtp frontend service would crash on Exchange 2013 and above. I use now mail users instead of mail contatcs, these could be validated by the UTM and AD query. Unfortunately, it still works only with LDAP unencrypted with UTM, not LDAPS

I meant that the SMTP Proxy apparently isn't using port 25 for recipient validation, otherwise, your original DNA should have been adequate.  I assume you also tried 'DNAT : Exchange -> {port 2525} -> Internal (Address) : to SMTP'.

Cheers - Bob